CVE-2026-12000

Name of the Vulnerable Software and Affected Versions Page and Post Restriction versions prior to 1.4.1

Description Sensitive information exposure occurs via the WordPress core REST endpoints '/wp-json/wp/v2/pages', '/wp-json/wp/v2/pages/', '/wp-json/wp/v2/posts', and '/wp-json/wp/v2/posts/'. The issue stems from the REST guards papr restrict page post rest api() and the the posts filter registered by papr filter posts() relying solely on papr get restricted posts id(). This function only reads the per-page metabox options papr allowed redirect for pages and papr allowed redirect for posts, ignoring the global toggles papr access for only loggedin and papr access for only loggedin posts used to make all pages or posts private. Consequently, unauthenticated attackers can read the full rendered content of every published page and post, bypassing the security boundary enforced by papr restrict logged in users() on the frontend.

Recommendations Update the plugin to a version later than 1.4.0.